On quantum cryptography with bipartite bound entangled 

states 

Pawei Horodecki* and Remigiusz Augusiak 

Faculty of Applied Physics and Mathematics, Gdansk University of Technology, 
Narutowicza 11/12, PL 80-952 Gdansk, Poland 



Abstract 

Recently the explicit applicability of bound entanglement in quantum cryptography 
has been shown. In this paper some of recent results respecting this topic are reviewed. 
In particular relevant notions and definitions are reminded. The new construction of 
bound entangled states containing secure correlations is presented. It provides low 
dimensional 6 ® 6 bound entangled states with nonzero distillable key. 

1 Introduction 

The explicit application of quantum entanglement in quantum information theory 
was the cryptographic protocol by Ekert T. The essential point of the protocol (cf. 
further modification [5]) was the entanglement monogamy principle (see [5]) which 
says that if the two particles are maximally entangled with each other then they are 
completely unentangled with any other (third) party. Hence, results of any correlation 
measurements on both particles must be completely safe from cryptographic point of 
view, as they are uncorrelated form results of any other measurement performed on 
the rest of the world. This point was further exploited in a nice application [4] of 
entanglement distillation [5] (cf. [6j). The idea of Ref. [4] is called quantum privacy 
amplification (QPA). Given stationary source of pure states Y&abe) describing Alice, 
Bob (which are cooperating) and Eve (eavesdropper) quantum correlations protocol 
QPA is focused on distilling maximally entangled states 

^ d i=0 

from quantum entangled states 

Qab = TteI^ABe^AbeI- (1-2) 

The distillation protocol uses local operations and classical communication (LOCC) 
which in presence of Eve are usually called local operations and public communication 
(LOPC). Once Alice and Bob distill maximally correlated states ) by entangle- 
ment monogamy they share log d bits of classical secure bits. This can be done by 
performing local measurements on the state (|1.1J) in standard bases {|£)>i}i=o an< ^ 

However, since 1998 it has been known that there is quantum entanglement called 
bound entanglement that can not be distilled to a pure form [7] . For a long time there 
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was a common belief that distillation of secure key from quantum state is possible 
only when QPA is. In other words, that bound entanglement is useless for quantum 
cryptography. In fact the results of extensive analysis of two qubit case [5] naturally 
suggested equivalence of entanglement distillation protocols and secure key distillation. 

Surprisingly it is not true, as it has been shown in papers [9j [10] . Before we shall 
recall main observations of the latter, let us point out the key ingredient of their 
reasoning. Namely, why QPA might be not necessary for distilling secure key? In 
fact, if Alice and Bob share maximally entangled state (|l.ip they in a sense have 
much stronger security than they need. In fact they will get secure correlations if 
they measure the state in any pair of bases of the form: {lei" 4 ') = U\i)A}fZo an< ^ 
{l e i B ' ) ) = ^*N)s}f=o 1 ' wnere U stands for arbitrary unitary operation. It is crucial to 
understand that in quantum cryptography it would be enough to have a single basis, 
measurement in which could give secure correlations. To be more specific, the security 
requirement is to get (via local measurement of Alice and Bob in one basis) the state 
that is product with Eve's degrees of freedom. 

This leads us to the notion of ccq state [12], i.e., tripartite state of Alice, Bob 
and Eve that is, after local von Neumann measurements, classical on Alice and Bob 
parts and quantum on Eve part. With this notion one can summarize the idea of 
[9l [TO] as follows: Alice and Bob should proceed to distill such a state Jaba'B' that, 
after considering its purification aba'B'e) and performing a local measurements in 
a standard product basis on its AB part the resulting ccq state qabe is (i) product 
with respect to the division AB\E (ii) contains maximal classical correlations between 
Alice and Bob. 

In this work we shall briefly describe main mathematical elements of the construc- 
tion [9] [10] , recall the idea of one-way distillation provided in [11] and provide a new 
construction of bound entangled states with secure quantum key. 

2 Main notions of general secure key distillation 
scheme 

Here we shall remind and discuss main ideas and notions introduced in Refs. [9[ I10j. 

Assume that Alice and Bob wish to communicate but without participation of an 
eavesdropper Eve. To this aim, as a source of quantum correlations, they use a quan- 
tum state qaba'B' ■ Here, subsystem AA' (BB r ) belongs to Alice (Bob). Moreover, 
following |9J, subsystem AB (A'B 1 ) is called the key part (shield part) of the given 
state. To make the considerations more formal, each subsystem of qaba'B' shall be 
represented by respective Hilbert space, i.e., Alice's subsystems by M'a and M'a 1 and 
Bob's by Jfb and M'b 1 ■ Hence, the key part of qaba' b' is defined on Jif = J{?a <8> 
and the shield part on M" = J^a» ® j%*b' ■ Hereafter we shall be assuming that 
dim M'a — dim J^b = d, dim J#a' = Aa>, and dim ^b 1 = &B' ■ 

Firstly, let us remind the notion of ccq state. To this aim let us introduce a product 
basis defined on Hilbert space M"a ® ~ C d ® C d , i.e., 



where {|e^ )}i=o,...,d— l and \\e\ )}j=o,...,d-i are arbitrary bases spanning the 
Hilbert spaces, respectively, J^a and M'b- Of course, these bases may be chosen to 
be standard and therefore SSab is the standard basis in C d <£> C d . Then we have the 
following 

Definition 1. (ccq state) We call the state qabe a ccq state of initial state 
Qaba'B' with respect to the basis £$ab if Qabe is a result of measurement of 
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Qabe = T^A'b'I^AbA'B'eY^ABA'b'e] in the product basis SS AB . Here \^aba'B'e) 
is a purification of Qaba' b' ■ 



As an illustrative example let us consider a density matrix t\aba' b 1 acting on 
(C 2 )® 4 and given by 7] A ba'B' = p|0111)(0111| + (1 - p)|1000)(1000|. As one may 
easily verify its standard purification takes the form \^aba'B'e) = v/p|01110) + 
a/1 — p|10001). Therefore, the ccq state of t\aba' b 1 with respect to standard basis 
S^l = {\i)a\j)b}\^ q is fjABE = p|010)(010| + (1 -p)|101)(101|. 

Now, one can ask when a given state is said to be secure. As an answer one gives 
the following (see [TUj ) 

Definition 2. (security) We call the state qabA'B' secure with respect to the basis 
■3$ AB if its ccq state is of the form 



Qabe = 



d-l 



PiM A)e j B) )(4 A)e j B) \ 



ij=0 



QE- (2.4) 



The security of such a state follows from the fact that Eve is completely uncorrelated 
from distribution represented by AB system after Alice and Bob measurement. Note 
that if the distribution is homogenous, i.e., pij — l/d; (i,j = 0,...,d— 1), then we 
say that Qaba'B' has a i^^-key. 

A very important ingredient of construction discussed here is a special class of 
controlled unitary operations (see [HI HO]) that we recall by the following 

Definition 3. (twisting) Let B ' be certain unitary operations acting on subsystem 
A' B' . For a given basis 3$ab we call the operation 

U=E^ef)ef)Xe^ef)|®U^' B ') (2.5) 

i,j=0 

^As-twisting or shortly, twisting. 



The importance of such a class of operations follows from the fact that applied to 
a given state qaba' b', U rfo not change its ccq state. It means that if we take qaba 1 b 1 
and c aba 1 B' = ^ Qaba 1 b 1 ^ \ their ccq states are exactly the same, i.e., qabe = &abe- 

Now we define the central notion of the generalised approach provided in [5J [TU] . 
This is the notion of private state that has log d bits of secure key encoded in its AB 
part of d Cg) d type). 

Definition 4. (pdit) Let qaba'B' is a density operator acting on the Hilbert space 
Jff (g> J€" and qa'B' is a density matrix acting on Jtf?' . Let \j[ A B ^ [i = 0, . . . , d — 1) 
be certain unitary operations acting on A' B' system. Then we call the state qaba'B' 
private state or pdit with respect to the basis £§ab if it is of the form 

d-l 

QABA'B' "I 2^ \ e i e i l\ e j e j l® U i QA'B'Vj ■ (2.b) 

i,j=0 

Hereafter, as usual, we shall denote the private dits by Jaba'B' ■ ^ n the case when the 
dimension of the key part is d = 2 on each side, we have to do with private bit or 
pbit. 

Now it is important to pose the question: What is the essential feature that allows 
private bit to be truly private ? Namely, a detailed analysis shows [HI IIP) that ccq state 
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of private bit i'abA'B' is the same as the ccq state of the following state (called basic 
pdit) 

V^9<r A 'B>, (2.7) 

where oa'B' = ^abJaba'B' an< ^ ^ + 1S a projector onto I^-l )■ This is because it is 

(2) 

always possible for a given pbit to find such a twisting under which Iaba'B' transforms 



it to (|2.7[) and conversely. Thus, after performing measurement in the basis &ab the 
physical system ABE is in the same state irrespective of whether before Alice and 
Bob state was (|2.7j) or just a pdit Iaba'B' ■ Hence the security with respect to the 
measurement in that particular basis is the same as if Alice and Bob really shared 
maximal entangled state ! This is the key observation for understanding the 
essence of private dit. 

We conclude the preliminary section racalling the definition of distillable key 
[51 [TU] and related theorem. 

Definition 5. (distillable key) Let gab be a density matrix acting on C dA <S> C dB and 
let ^ n be a sequence of LOCC operations such that & n (o~AB) = £„ , where E n is 
defined on C rf " <g> C dn <g> Jt? A > ® ^B' ■ The set @> = {^„}£° =1 is said to be a pdit 
distillation protocol of a given state o~ab if the following relation 



lim 

n — >o< 

The rate of this protocol is defined as 



v _ (<J„) 

lABA'B 1 



= 0. (2.. 

Tr 



R(&) = limsup (2.9) 

n,d n — ±00 •* 

and distillable key of o~ ab as 

K D (a AB )=supn(&>). (2.10) 

There is a problem however, since the above definition has a complicated form. 
It is hard to see whether given state fulfills the above condition or not. Fortunately, 
one can simplify the task providing necessary and sufficient conditions for nonzero 
distillable key that are more operational then the definition itself. Here we provide 
a summary of the conditions proven in [9l HOj , which are enough to analyse crypto- 
graphic usefulness of many quantum states: 



Theorem 1. The following three conditions are equivalent: 

(i) finite number of copies of state Qaba'B' can be transformed with some LOCC 
protocol into the state (Jab A' B' arbitrarily close in the trace norm to certain pbit 

(2) 
lABA'B' 

(ii) finite number of copies of state Qaba'B' can be transformed with some LOCC 

protocol into the state cfabA'B' with trace norm of the element Aq^ ^ ^ arbitrarily close 
to 1/2, where the element is defined by the representation: 

1 

QABA'B' 2^ l e * e j A 6 *; e l \®^j,kl ■ V 2 - 11 ) 

ij,k,l=0 

(Hi) the state g has nonzero distillable key, i.e., one has Kd(q) > 0. 
Moreover any convergence of ||Aq^^ to 1/2 from (ii) during a given protocol 
is equivalent to a convergence of the state to a certain pbit during that protocol. 

Especially the condition (ii) serves as a useful criterion which allows to adjudge 
an applicability of a given state to quantum cryptography. In next section we shall 
illustrate its power. 
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3 New class of bound entangled states with secure 
quantum key 



In this section we present the main result. We provide a construction of a state that 
is useful for quantum cryptography simultaneously being bound entangled. Note that 
the construction, however based on that presented in [11] , is different in details from 
known so far (9j [lOj [IT] and sheds some light on the still unexplored domain of bound 
entanglement. Hereafter it is assumed that d = 2, i.e., the key part of qaba'b 1 consists 
of qubits and that dim M'a' — dim Mb 1 = D, which allows us to write M" = C D ®C D . 
We may also assume for simplicity that 3%ab is standard basis in C 2 <B> C 2 . 



3.1 The construction 

To obtain a better insight into the construction we begin our considerations from an 
illustrative example with the shield part of dimension D — 3 on each side. This with 
the assumption that d = 2 makes the considered state to be of dimension 6 in each 
side. Finally, we show that the construction is possible for arbitrary D > 3. 

3.1.1 The 6 ®6 case 

At the very beginning suppose that Alice and Bob possess the following state (cf. [TT] ) 



QABA'B' = ~TZ 



11 

40 



l*3| 




X 3 



x. 



X 



a 3 




l*3| 



(3.12) 



where the superscript Tb> denotes the partial transposition with respect to the system 
B' and A3 is a symmetric 9x9 matrix of the form 



A 3 = — 
6 11 



10 

1 

1 

1 























-1 



1 

1 

1 





1 





1 





-1 



(3.13) 



which is defined on the Hilbert space J&a' ® ^b' — C ® C . In or- 
der to show that the matrix Qaba'b' is Hermitian and nonnegative, i.e., 
represents a quantum state, let us observe that A may be decomposed as 



A 3 = (1/11)(^| 3) - 2V^ + Q(3)). 

entangled state |1^ 3) ) = (l/V3)Ei= 
are projectors given by relations 



(3) 

Here V\_ is a projector onto the maximally 



belonging to 



and V {3 \ and Q {3) 



p< 3 > = $>Xi*|-Pi 3) . 

i=0 



2 

Ei 

i=0 



(3.14) 
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where 2g stands for an identity acting on the Hilbert space C 3 
projectors are orthogonal and therefore one obtains 



These above 



\Xa\ = — 

I 31 n 



,(3) 



2V 



(3) 



Q(3) 



1 

IT 



5 
3 





__L 

3 





__L 

3 





1 
1 
1 








_ 1 

3 





5 
3 





__L 

3 













1 
1 
1 




3 





_ _L 

3 







(3.15) 

From the above equation one infers two facts, first that the trace norrro of X3 is 
H^Hti = 1 and the second that |X3| Ts ' > 0. Moreover, the matrix X3 partially 
transposed with respect to the subsystem B' may be written in the form X^ B ' = 
(1/11) [2S^ — (2g — Q^ 3 ))] , where is a projector given by 



S< 3 > = - 
2 



Z 9 + V( 3 >-2^> 



2 = 



(3.16) 



with l/ 3 ) being the swap operator defined by relation V^ 3 -* Iv^i) |<^2) = | ^2 ) I V^i ) f° r 



l¥>i> G C 3 (i 
therefore IX* 



1,2). Note that T 9 
= (1/11)[25( 3 )+X 9 - 



one may easily conclude that \X 3 



Q( 3 ' and S^ 3 ' are orthogonal projectors and 
Q( 3 )]. Since \X^'\ Tb ' = (1/11) [ivf + Q^] , 

B ' > 0. This with the aid of the fact that the 
matrix X3 is symmetric and real, ensures that Qaba'B' represents a quantum state. 

Now we are in position to prove that Qaba'B' satisfies PPT (positive partial trans- 
pose) criterion [13l[T4]. To this aim we show that transposition with respect to subsys- 
tem BB' preserves the positivity. Indeed, the state qaba 1 b> transposed with respect 
to the BB' subsystem, remains a positive operator. To see this fact explicitly, we 
write 

" \X*\ Tb ' 



T BB , 11 

Qaba'B 1 — ^ 



l 3 
L 3 





\X, 



(3.17) 



Positivity of the above operator stems from two facts. As previously mentioned 
1-^3 \ Tb ' _ * and on the other hand the off-diagonal elements are blocked by \X^ B ' I. 



3.1.2 Construction of general 2D g> 2D case 

Trying to generalize the above investigations we start from the symmetric matrix 



Xn = 



1 



D 2 + 2D - 4 



(D - 2)V ( + D) - 2V (D) + Q 



(D) 



(3.18) 



where, as previously, represents a projector onto maximally entangled state 

l^^}. Orthogonal projectors p( D ) and are given by 



D-l 



D-l 



pw = i«x«i - v 



(D) 
+ ' 



(3.19) 



i=0 



1 For an arbitrary matrix H the trace norm is defined by relation ||H||ti = TrvHtH. 
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From Eq. (|3.18|) we have 

\X D ' 



1 



D 2 + 2D - 4 



(D - 2)V { + D) + ZP™ + 



(3.20) 



and therefore |Ad| Tb ' > 0. Subsequently, after elementary steps, we may obtain 
x d b ' = ^/(D 2 + 2D- 4)][2S( D ) - (1 D 2 - Q( D ))] with S^> being defined as 



S (D) 



D-l 



11 XM 



i=0 



(3.21) 



where is the swap operator acting on <C D (3<C D . Again, the projectors!^ 2 — 
and are orthogonal and therefore 



X 



D 



1 



D 2 + 2D - 4 



2,S( D )+X D2 -Q^ 



(3.22) 



Finally, performing partial transposition with respect to subsystem B' , we have 



' = [l/(D 2 + 2D - A)][DVf ] + Q (D) ] and therefore |A^ S T S ' > 0. Now we 



\ A D 

can introduce a class of mixed states 

1**1 



T H ,\T B 



ID) 



1 D 2 + 2D - 4 



Saba'B' — A 



4 D 2 + D -2 








X 



X 






1**1 



(3.23) 



Again, by virtue of the fact that |Xd| Tb ' > one may infer that partial transposition 
with respect to subsystem BB' preserves the positivity of Q^abA'B'- ^ n other words, 
the following matrix 



n {D)T BB _ _ 
"ABA'B' ~ a ' 





" \X D \ T B' 











1 D 2 + 2D - 4 





A D 


Xl B ' 





4 D 2 + D-2 





Y T B> 
A D 


A D 
















\x D \ T * 



(3.24) 



possess the nonnegative eigenvalues. 



3.2 Proof of nonzero distillable key K D 

Since the state Qaba'B' gi yen by Eq. (|3 . 23[1 is PPT one might expect that it is 
separable - it satisfies necessary (PPT) condition for separability [13] . However this is 
not the case. This is in agreement with the fact [14] that PPT condition is sufficient for 
separability only for the cases M<g>N, MN < 6 while here we have MN = (2D) 2 > 36. 
Like in [9] we shall prove nonseparability of (Saba's 1 m a vcrv nonstandard way. We 
simply show that the state has nonzero Kr>. Such a state must be entangled since, 
due to seminal result of Ref. [15], any separable state has Kd = 0. Because state is 
PPT and entangled it must be bound entangled [7J. 

To prove the cryptographic use of qaba' b' , below we show that there exist a 
LOCC protocol that allows Alice and Bob to approach arbitrarily closely to some pbit 

(2) 

IabA'B 1 - Note that, obviously, since LOCC operations preserves PPT property (see 
[7J), the resulting state is still bound entangled. Given k copies of the state qaba'B' 
in the i-th step of the protocol Alice and Bob perform the following operations: 

• They take the state Q^b^A'B' (* = L ■ ■ ■ j ^ — 1) an d one of remaining k — i + 1 
copies of qaba'B' (here q^ba'B' = Qaba'B')- 
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• They perform C-NOT operation treating qubits A and B of qaba 1 b' as source 
qubits and that of Qaba'B' as target qubits. 

• They perform a measurement of target qubits in computational basis and then 
compare their results. If both of them have the same results (00 or 11) then they 
keep the source state. Otherwise they get rid of it. 

After performing all k steps, with some probability they arrive at the following state 



(D,k) 

QabA'B' 



N. 



D.k 



\Xd\< 






X 



D 



X 



D 



v®k 
X D 








(3.25) 



where (for D > 3) 



N Dik = 2Tr\X D 



2Tr 



X 



D 



= 2 



D' 2 



If we define, according to (|2.11[) the matrix, A ( 



(A'B 1 ) 
00,11 



see that A. 



(A'B'), 



D 2 + 2D-A / 

(3.26) 

{D.k) = {l/N D . k )X% k we can 
for I? > 3. This means that 



''oo n C^>k) h> ~~ * 1/2 whenever k — > oo, 
repeating the whole procedure described above, one may find such a k that the trace 
norm of the upper right block of qF^}'B' IS c l° se to 1/2 with arbitrary precision. 
According to the the Theorem 1 (see Section 2) this convergence guarantees that the 
original state Qaba'B' defined by the formula (|3.23[) satisfies Kn > 0. The Theorem 2 
guarantees in particular, that (like it was in [9]) the above sequence of bound entangled 
states Qaba'B' approaches private bit. 



4 Summary and discussion 

We have summarized main elements of general scheme of distillation of secure key 
[9[ [TU] . The central notion of the scheme is the idea of private bit (with its natural 
generalization - private dit) which is the state that, in general, consists of two parts: 
the key part AB and the shield part A'B' . The first contains a bit of secure key. The 
role of the second part is - in a sense - to protect the key form Eve. A surprising fact, 
found in [5] is that PPT bound entangled states can approach private bit in trace 
norm. Since this convergence is a necessary and sufficient condition to distill secure 
key form the original state, this means that bound entangled states can serve as a 
source of distillable key [9[ [10] . 

First bound entangled states with nonzero distillable key K]j were provided in 
[§]. They required however very high dimensions. The small (4(g) 4) bound entangled 
states with nonzero distillable key were provided later in paper [IT] . 

Here we have provided new class of small (of, among others, 6 <g> 6 type) bound 
entangled states with that property. We have proven this fact applying an easy 
criterion form 9 showing that a given sequence of quantum states approaches the 
sequence of private bits. The LOCC protocol applied to produce such a sequence was 
of two-way type. As noticed in at some point the elements of the sequence got 
one-way distillable key which can be distilled with help of Devetak- Winter protocol. 
The original problem was that such states were of very high dimensions. Quite 
surprisingly the low-dimensional bound entangled states provided in [11 represent 
one-way distillable key. It was proven with help of the observation that any biased 
mixture of two private bits with second of them having the key part rotated locally 



S 



with a x Pauli matrix contains nonzero distillable key. Namely one has the following 
theorem [TT] : 

(2) (2) 

Theorem 2. For two private bits 7i , 7g one-way distillable key of the mixture of 
the form: 

P = Pili 2) +P24 A hi 2) ^ ) (4-27) 

with, <Jx A ^ — [o~ x ]a ® Ia'BB' satisfies Kp(p) > 1 — h(p\) with binary entropy /i(pijl. 
Here Kf^ (p) stands for cryptographic key distillable from p with help of forward clas- 
sical communication. The natural question is whether one can modify the 6 <£> 6 bound 
entangled states provided in the present paper to get mixture of two private bits of the 
above form. Our first analysis has shown that most probably it is impossible to turn 
our example into a state of the form (|4. 2T[) while keeping bound entanglement prop- 
erty. In Ref. pj] the construction leading to bound entangled state of the form (|4.27|) 
was based on some properties of states that were used in locking entanglement mea- 
sures effects. May be that was the reason why the construction was successful there. 
Still there is a natural question about other methods to construct low-dimensional 
bound entangled states with one-way distillable key. 

Of course the most important open problem is whether any entangled bipartite 
state contains nonzero distillable key or not. In multipartite case it is not true - there 
are states that are entangled but no secure key between any of the parties can be 
distilled [15]. In bipartite case lack of such states is guaranteed (via entanglement 
distillation approach [J]) only for 2 (g) 2 and 2 ® 3 cases, since, as shown in [T71 \TE\ , 
all the entangled states can be distilled to singlet form in those cases. For d®d with 
d > 4 it is known that at least some bound entangled (i.e. nondistillable to singlets) 
states have nonzero distillable key [IT] . No example of 3 <g> 3 or 2 ® 4 states with that 
property is still known. 
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